Generative AI systems copy data into places traditional data security never looked: embeddings, fine-tuned adapters, prompt logs, agent memory, tool calls and the context windows of other users. In March 2026 the OWASP GenAI Security Project published GenAI Data Security Risks and Mitigations 2026 (version 1.0), a catalogue of 21 data-layer risks numbered DSGAI01 to DSGAI21, each with tiered mitigations. This guide explains how the catalogue is structured, groups the 21 risks by where data actually lives in a GenAI system, turns the foundational mitigations into a rollout plan, and maps them to NIST, ISO and the OWASP Top 10 for LLM Applications. It is for data security, privacy and AI platform teams; prompt and response DLP is covered separately in the Generative AI Data Loss Prevention Guide.
Key takeaways
- Data security for GenAI is a lineage problem. Sensitive data persists in derived artefacts (embeddings, adapters, backups, logs) after the source is deleted, so classification and erasure have to follow the data into every derivative.
- Agents are now a data security risk in their own right. OWASP lists agent identity and credential exposure (DSGAI02) and tool, plugin and agent data exchange (DSGAI06) alongside classic leakage.
- Start with Tier 1 controls. OWASP defines Tier 1 as foundational controls achievable in about one sprint with existing tooling; most organisations have not yet done them.
- Telemetry is a leak path. Prompt logs, traces and monitoring stores hold the same sensitive data as the model's context and are often less protected (DSGAI14).
- Synthetic and "anonymised" data is not automatically safe. Quasi-identifiers and model memorisation can re-identify people, so classify derived data at the same level as its source until proven otherwise (DSGAI10).
What the OWASP document is
- Publisher and version: OWASP GenAI Security Project, GenAI Data Security Risks and Mitigations 2026, Version 1.0, March 2026, published on genai.owasp.org on 17 March 2026 under CC BY-SA 4.0.
- Scope: the data layer of GenAI, from training and fine-tuning datasets through retrieval stores and agent tooling to user prompts, outputs and telemetry. It also includes a section on data security posture management for GenAI (AI-DSPM).
- Entry format: each risk has an attack description, an illustrative scenario, attacker capabilities, impact, tiered mitigations, known CVEs or exploits and references.
- Mitigation tiers: Tier 1 Foundational (about one sprint, existing tooling), Tier 2 Hardening (architecture change, new tooling or cross-team work), Tier 3 Advanced (a mature programme, for example red teaming, differential privacy or custom detection).
- Buy, Build or Both: each control is tagged by whether you would typically buy it, build it or combine the two, which helps procurement and platform teams split the work.
Read it as version 1.0: when checked on 27 October 2026 some sections cross-referenced DSGAI25 and DSGAI26, which do not exist in the 21-entry list, so expect revisions.
The 21 risks grouped by where the data lives
| Data location | OWASP risks | What goes wrong |
|---|---|---|
| Model inputs and outputs | DSGAI01 Sensitive Data Leakage; DSGAI15 Over-Broad Context Windows and Prompt Over-Sharing; DSGAI18 Inference and Data Reconstruction | Models and RAG systems reproduce PII, secrets or IP verbatim; more context than the task needs is sent to the model |
| Identities and integrations | DSGAI02 Agent Identity and Credential Exposure; DSGAI06 Tool, Plugin and Agent Data Exchange Risks; DSGAI16 Endpoint and Browser Assistant Overreach | Agents inherit over-scoped, long-lived operator tokens; plugins, MCP servers and agent hand-offs forward full context to untrusted endpoints |
| Training and pipeline data | DSGAI04 Data, Model and Artifact Poisoning; DSGAI05 Data Integrity and Validation Failures; DSGAI10 Synthetic Data, Anonymisation and Transformation Pitfalls; DSGAI17 Data Availability and Resilience Failures in AI Pipelines; DSGAI21 Disinformation and Integrity Attacks via Data Poisoning | Tampered artefacts and poisoned training or RAG data; format-valid payloads corrupt datasets; snapshot imports enable path traversal |
| Retrieval and storage | DSGAI11 Cross-Context and Multi-User Conversation Bleed; DSGAI12 Unsafe Natural-Language Data Gateways (LLM-to-SQL/Graph); DSGAI13 Vector Store Platform Data Security | Shared session state, KV caches or vector indexes leak one user's or tenant's context into another's |
| Operations and people | DSGAI14 Excessive Telemetry and Monitoring Leakage; DSGAI19 Human-in-the-Loop and Labeler Overexposure; DSGAI09 Multimodal Capture and Cross-Channel Data Leakage | Logs, traces, labelling queues and OCR or transcript outputs hold sensitive data outside text-focused controls |
| Governance and compliance | DSGAI03 Shadow AI and Unsanctioned Data Flows; DSGAI07 Data Governance, Lifecycle and Classification for AI Systems; DSGAI08 Non-Compliance and Regulatory Violations; DSGAI20 Model Exfiltration and IP Replication | Unapproved tools receive sensitive data; labels and lineage are missing; lawful basis, consent and erasure duties are not met in ML pipelines |
The grouping and the "what goes wrong" column are NHI Mgmt Group's reading; the risk IDs and names are OWASP's (names shown with British spelling).
Foundational controls per risk
The table lists Tier 1 and early Tier 2 mitigations named by OWASP for the entries we could read in full. For the remaining entries, apply the control families in the next sections.
| Risk | Mitigations OWASP names | Owner |
|---|---|---|
| DSGAI01 Sensitive Data Leakage | Redact before indexing; scan outputs for sensitive content; enforce per-document access control in retrieval; block exfiltration through rendered links; differential privacy at the advanced tier | AI platform, data security |
| DSGAI02 Agent Identity and Credential Exposure | Per-agent identities; task-scoped, short-lived credentials; vaulted secrets; just-in-time access | IAM and NHI team |
| DSGAI03 Shadow AI and Unsanctioned Data Flows | Shadow AI policy; central AI service catalogue; DLP and CASB; vendor contracts; governed enterprise alternatives | Security governance, procurement |
| DSGAI04 Data, Model and Artifact Poisoning | Data bill of materials (DBOM) on CycloneDX ML-BOM; artefact signing; sandboxed model loading; registry write protection; canary datasets | MLOps |
| DSGAI05 Data Integrity and Validation Failures | Strict schema enforcement; semantic validation; hardened import paths that refuse symlinks; integrity checks | Data engineering |
| DSGAI06 Tool, Plugin and Agent Data Exchange Risks | Allow-listing backed by data processing agreements; kill switches; context minimisation; mTLS and signed messages; task-scoped tokens; central logging | AI platform, IAM |
| DSGAI07 Data Governance, Lifecycle and Classification | Classification propagated to derived artefacts; erasure that covers derivatives; data-to-model lineage; automated retention | Data governance |
| DSGAI08 Non-Compliance and Regulatory Violations | DPIA process for AI systems; lawful basis documentation; retention and erasure obligations extended to ML pipelines | DPO, legal |
| DSGAI09 Multimodal Capture | High-sensitivity default classification; OCR and ASR-based PII and secret detection; short TTLs for transient multimodal storage; training opt-out for user content | AI platform, privacy |
| DSGAI10 Synthetic Data and Anonymisation Pitfalls | Default classification parity with the source; schema governance; dataset bill of materials | Data governance |
Control families that cover the whole catalogue
Lineage and classification
- Tag at ingestion: every chunk, embedding, adapter and dataset carries the source ID and classification of the data it came from (NIST CSF 2.0 ID.AM-07 data inventories). See the Data Classification Guide.
- Erasure that follows derivatives: a deletion or GDPR erasure request triggers removal from the vector store, re-indexing, and a decision on whether affected fine-tunes must be retrained. Map it to NIST SP 800-53 SI-12 Information Management and Retention.
- Data bill of materials: record datasets, sources, licences and transformations for every model you train or fine-tune. See the AI Supply Chain and AI-BOM Guide.
Retrieval and storage isolation
- Permission-aware retrieval: enforce the requesting user's entitlements at query time, not only at ingestion (AC-3 Access Enforcement). See the Permission-Aware RAG Guide.
- Tenant isolation: separate indexes, namespaces or encryption keys per tenant for DSGAI11 and DSGAI13; never rely on a metadata filter alone in a shared index. See the OWASP LLM Top 10 LLM08 Vector and Embedding Weaknesses Guide.
- Natural-language data gateways: for LLM-to-SQL or graph tools (DSGAI12), run generated queries under a read-only, row-scoped database identity, never the application's owner account.
- Encryption at rest: vector stores, prompt logs and adapter weights fall under SC-28 Protection of Information at Rest like any other data store.
Context minimisation
- Send only what the task needs: retrieval top-k limits, field-level filtering of tool responses and summarisation before hand-off reduce DSGAI15 and DSGAI06 exposure.
- Strip secrets before context: scan retrieved documents and tool outputs for credentials before they enter a prompt.
Telemetry and human review
- Classify logs as the data they contain: prompt and trace stores inherit the highest classification of the data that flows through them; restrict access and set retention (AU-11 Audit Record Retention).
- Redact before review: labelling and human-in-the-loop queues (DSGAI19) should show reviewers the minimum fields, under named access with logging.
Where identity fits
Two of the first six OWASP data risks are identity failures. An agent that holds a broad, long-lived token turns every prompt injection or tool compromise into bulk data access, and a RAG pipeline that indexes with a super-user service account defeats per-document permissions. Give each agent and pipeline its own identity, scope tokens to the task, store secrets in a vault and log every data access by identity (PR.AA-05). See the Credential Vaulting for AI Agents Guide and the Agent Identity and Access Guide.
How to implement
- Map data flows: for each GenAI system, list sources, indexes, models, adapters, logs, tools and outputs, and the identity used at each hop. Mark which hold personal, secret or regulated data.
- Score against the 21 risks: mark each DSGAI entry as not applicable, mitigated, partially mitigated or open per system.
- Do Tier 1 first: per-agent identities, output scanning, retrieval access control, log classification and retention, a shadow AI catalogue, DPIAs. Target one sprint per system, as OWASP intends.
- Pilot in monitor mode: run output scanning and retrieval access checks in log-only mode for [2 to 4 weeks], measure false positives, then enforce.
- Move to Tier 2 for high-risk systems: tenant-isolated indexes, lineage-driven erasure, signed artefacts, mTLS between agents and tools.
- Roll back safely: keep previous index versions and access policies so a mis-scoped filter that breaks retrieval can be reverted without disabling controls entirely.
- Reassess quarterly and when OWASP revises the catalogue.
Decision guidance
- Buy or build: use OWASP's Buy, Build or Both tags. Discovery and posture (AI-DSPM, CASB, DLP) are usually bought; lineage, retrieval authorisation and context minimisation are usually built into your platform.
- Small organisations: using SaaS copilots only, focus on DSGAI01, DSGAI03, DSGAI07 and DSGAI14: label data, restrict what the assistant can search, approve tools and check vendor retention terms. See the DSPM Buyer's Guide.
- Large organisations building platforms: the identity, isolation and lineage families matter most, because one shared index or service account multiplies exposure across every application.
What to ask of AI-DSPM tooling
The OWASP document gives AI-DSPM its own section, and posture tools are the usual way to find the GenAI data stores nobody registered. When evaluating one, test it against your own estate rather than a demo tenant.
- Discovery: does it find vector databases, managed vector indexes, fine-tuning datasets, model registries and prompt log stores, including in development accounts?
- Classification in derived stores: can it sample embeddings' source text or chunk metadata and report personal or secret data inside an index, not only in the source bucket?
- Identity context: does it show which service accounts, agents and users can read each store, so you can spot a pipeline identity with access to everything?
- Lineage: can it link a source document to the indexes and datasets built from it, which is what an erasure request or an incident needs?
- Flows to third parties: does it detect data sent to external model APIs and observability services, with the destination and volume?
Detection and measurement
- Log: retrieval queries with the requesting identity and documents returned; output scanner hits; tool calls with destination and data volume; erasure jobs and which derived stores they touched.
- Alert on: retrieval of documents above the user's clearance, cross-tenant results, secrets in outputs or logs, agent tokens used outside their task window.
| Metric | Shows |
|---|---|
| Percentage of GenAI systems scored against all 21 DSGAI risks | Coverage of the assessment |
| Percentage of index chunks carrying source ID and classification | Lineage readiness for erasure and incident response |
| Agents and pipelines using a dedicated, task-scoped identity | DSGAI02 progress |
| Erasure requests completed across all derived stores within the statutory deadline | DSGAI07 and DSGAI08 effectiveness |
| Sensitive-data hits in prompt and trace logs per month | DSGAI14 exposure trend |
Framework mapping
| Framework | Reference | Relevant DSGAI risks |
|---|---|---|
| OWASP Top 10 for LLM Applications 2025 | LLM02:2025 Sensitive Information Disclosure; LLM03:2025 Supply Chain; LLM04:2025 Data and Model Poisoning; LLM08:2025 Vector and Embedding Weaknesses | 01, 04, 11, 13 |
| NIST SP 800-53 Rev. 5 | AC-3, AC-6, SC-28, SI-12, SI-19 De-identification, PT-2, AU-11 | 01, 02, 07, 08, 10, 14 |
| NIST CSF 2.0 | ID.AM-07, PR.AA-05, PR.DS-01, PR.DS-02, PR.DS-10 | Whole catalogue |
| NIST AI 600-1 Generative AI Profile | Data privacy and information security risks | 01, 08, 18 |
| MITRE ATLAS | AML.T0057 LLM Data Leakage; AML.T0020 Poison Training Data; AML.T0024.002 Extract AI Model | 01, 04, 20 |
| ISO/IEC 27001:2022 Annex A | A.5.12 Classification of information; A.5.34 Privacy and protection of PII; A.8.11 Data masking; A.8.12 Data leakage prevention | 01, 07, 08, 10 |
| GDPR and EDPB | Articles 5, 17 and 35; EDPB Opinion 28/2024 on AI models | 07, 08, 10 |
Common failure patterns
- Plaintext conversation stores: the McKinsey Lilli research disclosure described 46.5 million chat messages in plaintext and millions of RAG chunks reachable through unauthenticated APIs (a researcher claim; McKinsey said forensics found no evidence of client data access).
- Secrets pasted into chats: the claimed OmniGPT breach allegedly included uploaded files containing API keys and credentials, which is DSGAI01 and DSGAI14 in one incident.
- Deleting the source but not the embedding: erasure requests close the ticket while the vectors and adapters keep the data.
- One service account for the whole index: retrieval returns whatever the indexer could read, regardless of the user.
- Treating synthetic data as unclassified: it is shared with vendors or labellers without the controls the source data had.
- Ignoring telemetry: prompt logs sent to a third-party observability tool with default retention.
Practitioner checklist
- Every GenAI system has a data flow map and a score against DSGAI01 to DSGAI21.
- Agents and pipelines use dedicated, task-scoped, vaulted credentials.
- Retrieval enforces the requesting user's permissions at query time; tenants are isolated by index or key.
- Chunks, embeddings and adapters carry source and classification; erasure covers derivatives.
- Prompt, trace and labelling stores are classified, access-controlled and retention-limited.
- Outputs are scanned for sensitive data and external link rendering is restricted.
- Datasets and models have a data bill of materials and signed artefacts.
- DPIAs and lawful basis records exist for training and fine-tuning on personal data.
- Shadow AI tools are discovered and either approved, replaced or blocked.
Standards and references
- OWASP GenAI Security Project: GenAI Data Security Risks and Mitigations 2026
- OWASP: Top 10 for LLM Applications 2025
- NIST: AI 600-1 Generative Artificial Intelligence Profile
- NIST: SP 800-53 Rev. 5
- NIST: Cybersecurity Framework 2.0
- EDPB: Opinion 28/2024 on data protection aspects of AI models
- MITRE ATLAS: LLM Data Leakage
Related NHI Mgmt Group resources: Generative AI Data Loss Prevention Guide · RAG Security Guide · Shadow AI Discovery Guide · AI and GDPR Guide